FreeRDP from 2.0.0 before 3.32.0 contains an improper certificate validation vulnerability in its proxy that accepts untrusted target TLS certificates when no verification module is configured. Network-positioned attackers can intercept the proxy's outbound connection and present a self-signed, wrong-hostname certificate to impersonate the RDP target and receive proxied session data.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3342 advisory.

    Fix GHSA-66mr-7wc7-23vc: FreeRDP client can abort while logging a malformed RDPDR device announcement

    Fix GHSA-x7w3-32ch-x2jq: winpr image conversion: heap over-read encoding 16 bpp DIBs to PNG; malformed     PNG/JPEG abort or exit the process

    Fix GHSA-fqw6-jf2h-6fj6: RDPGFX ALPHA `WIRETOSURFACE_2` command can abort a FreeRDP client

    Fix GHSA-m7xq-5f7v-hjvw: FreeRDP proxy has no cumulative limit for intercepted DVC message reassembly

    Fix GHSA-2557-79qc-6gfr: FreeRDP WinPR Kerberos SSPI retrieveSomeTgt double free of the default realm

    Fix GHSA-jqf4-4p68-4p43: Opted-in GLYPH_INDEX client abort from unrepresentable background width

    Fix GHSA-r387-jjq3-87hv: Serial RDPDR device-control output length can exhaust FreeRDP client memory

    Fix GHSA-8rjm-m7xg-mg6m: RD Gateway extended-auth packet crashes FreeRDP client before tunnel     authentication

    Fix GHSA-cx9c-q4jc-wm6c: Dynamic rdpsnd channel close leaves playback thread using a freed callback

    Fix GHSA-983v-jp34-f3fm: FreeRDP smartcard emulation: use-after-free in ReleaseContext racing in-flight     GetStatusChange

    Fix GHSA-8g9g-hqqp-fw69: FreeRDP client leaks file descriptors on repeated parallel-device CREATE     requests, allowing a hostile RDP server to exhaust the client process

    Fix GHSA-f53w-3364-jr35: FreeRDP RDPGFX CREATE_SURFACE integer wrap causes a 32-bit heap overwrite

    Fix GHSA-x8vp-ff7m-294g: Authenticated remdesk channel payload aborts FreeRDP shadow server through     stream-capacity assertion

    Fix GHSA-m59q-wm7v-mp57: FreeRDP RDPGFX client: heap out-of-bounds write in HashTable_GetKeys via surface-     key truncation

    Fix GHSA-j536-qc58-pmf8: Partial Early User Authorization reads can overflow a FreeRDP client receive     buffer

    Fix GHSA-wg7g-gx9g-r96c: FreeRDP truncated GSM610/WAV49 audio causes an out-of-bounds read

    Fix GHSA-799q-hjgw-g55g: WinPR image readers abort/exit the client process on malformed PNG/JPEG (missing     library error handling)

    Fix GHSA-x26g-fp9v-c2pg: FreeRDP WebSocket client spins indefinitely when TLS closes during a frame     payload

    Fix GHSA-6wqx-rv3q-vcxp: FreeRDP client use-after-free in the rdpgfx dynamic virtual channel on channel     close

    Fix GHSA-2c9x-4gr7-hrwx: Zero-output ZGFX payload aborts FreeRDP RDPGFX clients

    Fix GHSA-fqcj-rwww-2498: Zero-length dynamic-channel DATA messages can spin FreeRDP shadow-server threads

    Fix GHSA-q82v-5wjg-6h57: FreeRDP RD Gateway RPC client heap buffer overflow in rpc_client_recv_fragment

    Fix GHSA-5qqp-5ffm-m3p9: Malformed drive request silently stops FreeRDP's drive worker and leaves later     requests queued

    Fix GHSA-qw7w-hhxq-763c: FreeRDP proxy DRDYNVC tracker race causes use-after-free and process crash

    Fix GHSA-3pg4-5r42-wxvj: Unauthenticated shadow-server abort on TSRequest without negoTokens

    Fix GHSA-4vh4-3pc3-32p7: RD Gateway packet length causes 2 GiB client allocation before tunnel     authentication

    Fix GHSA-xc85-4mqc-xgcx: FreeRDP proxy out-of-bounds write in bitmap cache v2 capability handling

    Fix GHSA-w897-ffhv-5j7g: USB redirection control-channel close can race a channel write in FreeRDP

    Fix GHSA-v85m-wg84-5ffh: FreeRDP URBDRC frees active libusb transfers during teardown

    Fix GHSA-x4x6-2hrm-hvq9: RD Gateway control packet can make FreeRDP client spin at full CPU

    Fix GHSA-jq25-3374-4262: Incomplete fix for GHSA-43hh-p3vw-hfx3: CN-fallback and IP-literal cert identity     checks were never patched

    Fix GHSA-fg78-v8j5-8697: FreeRDP planar codec: non-atomic geometry and buffer update on failed     ResetGraphics causes heap out-of-bounds write

    Fix GHSA-rrp5-666j-g6gp: FreeRDP DRDYNVC DATA_FIRST length causes an uncapped client allocation

    Fix GHSA-c426-ppvf-jpfg: Zero-width RDPGFX ResetGraphics causes a later FreeRDP X11 client crash

    Fix GHSA-xjhw-2r55-m95g: FreeRDP planar bitmap decode: RDPGFX ResetGraphics race causes use-after-free of     shared planar buffers

    Fix GHSA-v3q2-qjvf-7rqw: FreeRDP proxy dyn-channel-dump session teardown causes cross-thread use-after-     free



    FreeRDP before 3.32.1 contains a heap-based out-of-bounds read in WinPR's clipboard PNG-to-CF_DIB     synthesis because winpr_read_png_from_buffer() allocates a bit-packed buffer for PNGs with bit depth below     8, while winpr_bitmap_write_buffer() copies rows assuming one byte per pixel. A malicious RDP server can     send a crafted low-bit-depth PNG clipboard payload that, when pasted by the victim, discloses megabytes of     heap memory. (CVE-2026-114043)

    FreeRDP before 3.32.1 contains a heap-based buffer overflow in the server-side rdpsnd channel because an     integer wraparound in rdpsnd_server_select_format() DVI_ADPCM block-alignment arithmetic bypasses     validation. A malicious RDP client can send two SNDC_FORMATS PDUs with an nBlockAlign too small for     nChannels, causing an unbounded heap write during server audio playback, potentially enabling code     execution. (CVE-2026-114045)

    FreeRDP 3.0.0 before 3.32.0 contains a null-pointer dereference in the smartcard emulation backend that     accepts a null per-reader name in SCardGetStatusChange requests. A malicious RDP server can send a crafted     reader-state entry with a null szReader, causing strcmp or _wcscmp to crash the client process.
    (CVE-2026-114046)

    FreeRDP from 2.0.0 before 3.32.0 contains an improper certificate validation vulnerability in its proxy     that accepts untrusted target TLS certificates when no verification module is configured. Network-     positioned attackers can intercept the proxy's outbound connection and present a self-signed, wrong-     hostname certificate to impersonate the RDP target and receive proxied session data. (CVE-2026-114047)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - FreeRDP from 2.0.0 before 3.32.0 contains an improper certificate validation vulnerability in its proxy     that accepts untrusted target TLS certificates when no verification module is configured. Network-     positioned attackers can intercept the proxy's outbound connection and present a self-signed, wrong-     hostname certificate to impersonate the RDP target and receive proxied session data. (CVE-2026-114047)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
373914	Amazon Linux 2023 : freerdp, freerdp-devel, freerdp-libs (ALAS2023-2026-3342)	Nessus	Amazon Linux Local Security Checks	Local	high
369684	Linux Distros Unpatched Vulnerability : CVE-2026-114047	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-114047

high

Tenable Plugins

high

high